@dynamoprotocol/mcp — monetize MCP tool servers with capped, revocable allowances

Payment middleware for Model Context Protocol tool servers: callers present an offline-verifiable allowance credential; the paywall verifies it in process against your pinned signer (no network call in the tool path), gates on locally cached headroom that DENIES when stale, and meters usage asynchronously against a running dynamo-core. Every failure path denies — fail closed.

Install

npm install @dynamoprotocol/mcp

Two-minute quickstart

import { Paywall, wireMeterBackend, attachMonetizedTools } from "@dynamoprotocol/mcp";

const serviceNode = process.env.DYNAMO_SERVICE_NODE;  // your payee address
const paywall = new Paywall({
  backend: wireMeterBackend({
    engineUrl: process.env.DYNAMO_CORE_URL,           // your dynamo-core
    expectedSigner: process.env.DYNAMO_ENGINE_SIGNER, // pinned trust anchor
  }),
  serviceNode,
});

// Wrap your MCP tool handlers: unpaid calls get a structured x402-shaped
// tool error; paid calls run and are metered by declared unit cost.
const [tool] = attachMonetizedTools(server, [
  {
    name: "summarize",
    description: "Summarize a document",
    inputSchema: { text: z.string() },
    priceUnits: 1_000n,
    handler: mySummarize,
  },
], { paywall, serviceNode });

// Background loops (the tool path itself never awaits the network):
setInterval(() => paywall.sync(knownStreamId), 5_000);  // headroom refresh
setInterval(() => paywall.flushMetering(), 5_000);      // async metering, never dropped

Buyers answer the challenge with @dynamoprotocol/sdk: open a budget and a capped stream on their own core, attach stream.credential() to the tool call.

What this does NOT do

• It moves no money by itself. Credentials backed by Control Mode are free enforcement — caps and a signed meter, no payments. Real value (stablecoin escrow or card authorization-backed budgets) is a property of the buyer's core deployment; the paywall neither knows nor cares.
• It never inspects or transmits tool request/response content. Units are payload-neutral — your tool's vocabulary maps to units at your boundary.
• It never fails open: absent, malformed, expired, wrong-signer, revoked, exhausted, or stale-cache credentials are all denied.

See CHANGELOG.md for the 2.0.0 surface and deprecation notes.

Docs: https://github.com/DynamoProtocol/dynamo-open · License: Apache-2.0